CVE-2024-49737: Android Framework Base Package Local Escalation of Privilege Vulnerability
Summary
CVE-2024-49737: In applyTaskFragmentOperation of WindowOrganizerController.java, there is a possible way to launch arbitrary activities as the system UID due to a logic error in the code. Affects platform/frameworks/base across 4 version ranges.
>= 13:0, < 13:2025-01-01
>= 14:0, < 14:2025-01-01
>= 15:0, < 15:2025-01-01
>= 15-next:0, < 15-next:2025-01-01
Fixed in 15-next:2025-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Framework Base package is a core component of the Android operating system, providing essential functionalities and APIs for application development. It serves as the foundation for various system-level operations and user interactions. This package is critical for maintaining the integrity and security of the Android environment, making it susceptible to vulnerabilities that could compromise system security.
Vulnerability Detail
In the WindowOrganizerController.java file, a logic error allows for the potential launching of arbitrary activities with system UID privileges. This vulnerability can lead to local escalation of privilege (EoP) without requiring additional execution privileges or user interaction, posing a significant security risk to the Android ecosystem.
How To Fix
Minimum fixed version
15-next:2025-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the available patches as soon as possible to mitigate the risk.
Conclusion
The CVE-2024-49737 vulnerability in the Android Framework Base package poses a significant risk of local privilege escalation. It is essential for developers and users to apply the provided patches promptly to secure their applications and devices against potential exploitation.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2024-49737 is a vulnerability in the Android Framework Base package that allows for local escalation of privilege due to a logic error in the code.
This vulnerability could allow malicious applications to launch arbitrary activities with system privileges, potentially compromising the security of the device.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
No, user interaction is not needed for exploitation, making it particularly dangerous.
While there are no specific workarounds, it is crucial to prioritize updating the package to the patched version to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
